CN115695206A

CN115695206A - Method and device for determining network topology, computer equipment and storage medium

Info

Publication number: CN115695206A
Application number: CN202211356190.1A
Authority: CN
Inventors: 蔡伟; 谭曙光
Original assignee: Beijing Huierte Technology Co ltd
Current assignee: Beijing Huierte Technology Co ltd
Priority date: 2022-11-01
Filing date: 2022-11-01
Publication date: 2023-02-03
Anticipated expiration: 2042-11-01
Also published as: CN115695206B

Abstract

The invention discloses a method for determining network topology, which comprises the steps of receiving a message of each target device in a plurality of target devices sent by a gateway device through a terminal device, wherein the message comprises an Ethernet message of the target device, an ARP/RARP message of the target device, a TCP/UDP message of the target device and an ICMP message of the target device, determining a VLan I D of a first target device and a VLan I D of a second target device according to the Ethernet message, determining an MAC address and a I P address of the first target device and an MAC address and a I P address of the second target device according to the ARP/RARP message. According to the I CMP message, the network topology relation of the target devices is determined, the target devices in the existing network do not need to be configured and upgraded, the terminal devices do not need to send requests to the target devices in the network, no message is generated in the process, the existing network is affected, and the using effect is better.

Description

Method and device for determining network topology, computer equipment and storage medium

Technical Field

The present application relates to the field of network topology technologies, and in particular, to a method and an apparatus for determining a network topology, a computer device, and a storage medium.

Background

The way computers are connected is called "Network Topology" (Network Topology). Network topology refers to the physical layout of the various devices interconnected by a transmission medium, particularly where computers are distributed and how cables run through them. When designing a network, the correct topology should be selected according to the actual situation. Each topology has its own advantages and disadvantages. Topology is an abstract representation method that describes the actual positions and relationships of a plurality of objects using only points or lines, regardless of the physical properties of the objects, such as size and shape. Topology is not concerned with the details of things, nor with their mutual proportionality, but rather represents the interrelationship between a number of objects within a certain range in the form of a graph. In real life, computers and network devices must be connected by using a certain organization structure, which is called a "topology structure". The network topology visualizes the arrangement and configuration of the network and the interrelationship between the nodes, and in general, the "topology" refers to how these computers and communication devices are connected together.

At present, generally, a network protocol is used to actively send a request to discover a device to acquire a connection relationship between network devices in a network. Such as traceroute, ping, etc. This solution requires each device to both support and operate the associated network services and to configure firewall related policies, while sending related protocol requests may affect the operation of the devices in the network. Moreover, in an industrial production network, most devices do not provide support for related network services, are not discovered in a mode of avoiding and hiding themselves in the network based on security considerations, and are not allowed to send ping and other requests to the production devices of the devices based on enterprise production requirements.

Therefore, the existing method for acquiring the connection relationship between each network device in the network needs to modify and configure the existing device in the network, and may affect the existing network, resulting in poor use effect.

Disclosure of Invention

Based on this, aiming at the above technical problems, a method, an apparatus, a computer device and a storage medium for determining a network topology are provided, which can solve the problems that in the existing method for obtaining the connection relationship between each network device in the network, the existing device in the network needs to be modified and configured, the existing network is affected, and the use effect is poor.

In a first aspect, a method for determining a network topology includes:

receiving a message of each target device in a plurality of target devices sent by a gateway device, wherein the message comprises an Ethernet message of the target device, an ARP/RARP message of the target device, a TCP/UDP message of the target device, and an ICMP message of the target device;

determining the VLanID of the first target device and the VLanID of the second target device according to the Ethernet message;

determining the MAC address and the IP address of the first target equipment and the MAC address and the IP address of the second target equipment according to the ARP/RARP message;

and determining the network topology relationship of the target devices according to the ICMP message.

In the foregoing solution, optionally, before determining the network topology relationship of the multiple target devices according to the ICMP packet, the method further includes:

and determining the MAC address and the IP address of the first target device and the MAC address and the IP address of the second target device according to the TCP/UDP message.

In the foregoing solution, further optionally, before determining the network topology relationship of the multiple target devices according to the ICMP packet, the method further includes:

dividing a plurality of logical networks according to the VLANID of the first target device and the VLANID of the second target device;

for each logic network, under the condition of receiving an ARP/RARP message of the first target equipment, binding the MAC address of the first target equipment and the IP address of the first target equipment, and judging as the first target equipment; meanwhile, the MAC address of the second target device and the IP address of the second target device are bound and judged as the second target device;

and under the condition that an ARP/RARP message of target equipment is not received, judging the type of the target equipment according to the MAC address or the IP address of the target equipment, wherein the target equipment is the first target equipment or the second target equipment.

In the foregoing solution, further optionally, the determining, according to the ICMP packet, a network topology relationship of a plurality of the target devices includes:

analyzing the ICMP message, determining that the first target device and the second target device are different devices under the condition that a PING message exists in the ICMP message, and determining the network topology relation of the first target device and the second target device.

In the foregoing solution, further optionally, the determining, according to the ICMP packet, a network topology relationship of a plurality of the target devices further includes:

analyzing the ICMP message, analyzing the Traceroute message according to a preset protocol under the condition that the ICMP message has the Traceroute message, determining whether the first target equipment and the second target equipment are the same target equipment, and determining the network topology relation of the first target equipment and the second target equipment under the condition that the first target equipment and the second target equipment are different equipment.

In the foregoing scheme, further optionally, the determining a network topology relationship of the plurality of target devices according to the ICMP packet further includes:

analyzing the ICMP message, and determining the network topology relationship between the first target equipment and the second target equipment according to the IP address of the first target equipment and the IP address of the second target equipment under the condition that a PING message and a Traceroute message do not exist in the ICMP message.

In the foregoing solution, further optionally, after determining the network topology relationships of the plurality of target devices according to the ICMP packet, the method further includes:

acquiring actual flow data between the first target device and the second target device within a preset time interval, and closing a third target device under the condition that an actual flow value corresponding to the actual flow data is smaller than a preset flow value; or the third target device is detached from the network;

wherein the third target device is the first target device or the second target device.

In a second aspect, an apparatus for determining a network topology, the apparatus comprising:

a receiving module: the device comprises a gateway device and a plurality of target devices, wherein the gateway device is used for receiving messages of each target device in the plurality of target devices, and the messages comprise Ethernet messages of the target devices, ARP/RARP messages of the target devices, TCP/UDP messages of the target devices and ICMP messages of the target devices;

a first determination module: the VLANID of the first target device and the VLANID of the second target device are determined according to the Ethernet message;

a second determination module: the MAC address and the IP address of the first target equipment and the MAC address and the IP address of the second target equipment are determined according to the ARP/RARP message;

a third determination module: and the network topology relation of the target devices is determined according to the ICMP message.

In a third aspect, a computer device comprises a memory and a processor, the memory storing a computer program, the processor implementing the following steps when executing the computer program:

In a fourth aspect, a computer readable storage medium having stored thereon a computer program which when executed by a processor implements the steps of:

The invention has at least the following beneficial effects:

the invention is based on further analysis and research of the problems in the prior art, realizes that in the existing method for acquiring the connection relation between each network device in the network, the existing device in the network needs to be modified and configured, the existing network can be influenced, and the use effect is poor.

Drawings

Fig. 1 is a schematic flowchart of a method for determining a network topology according to an embodiment of the present invention;

fig. 2 is a schematic diagram of an independent deployment framework of a method for determining a network topology according to an embodiment of the present invention;

fig. 3 is a schematic diagram of a distributed deployment framework of a method for determining a network topology according to an embodiment of the present invention;

fig. 4 is a schematic diagram illustrating an acquisition result of a network topology according to an embodiment of the present invention;

FIG. 5 is a diagram illustrating an internal structure of a computer device according to an embodiment.

Detailed Description

In order to make the objects, technical solutions and advantages of the present application more apparent, the present application is described in further detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the present application and are not intended to limit the present application.

In an embodiment, as shown in fig. 1 and fig. 2, a method for determining a network topology provided by the present application includes the following steps:

before receiving a message of each target device in a plurality of target devices sent by a gateway device, all mirror image messages are sent to the device through the gateway device, or all mirror images are sent to a certain storage device through the gateway device, and network message data are obtained through data import or direct access and the like.

Fig. 2 is a schematic diagram of an independent deployment framework of the method for determining a network topology according to an embodiment of the present invention

In one embodiment, before the determining the network topology relationship of the plurality of target devices according to the ICMP packet, the method further includes:

for each logic network, under the condition of receiving an ARP/RARP message of the first target equipment, binding the MAC address of the first target equipment and the IP address of the first target equipment, and judging as the first target equipment; meanwhile, binding the MAC address of the second target device and the IP address of the second target device, and judging as the second target device;

As shown in fig. 3, an enterprise may divide a plurality of local area networks according to departments or workshops, so that each local area network deploys a device operating the method, and then converges to a top-level device, and the device generates complete topology information from network topologies of the plurality of local area networks. Fig. 3 is a schematic diagram of a distributed deployment framework of the method for determining a network topology according to an embodiment of the present invention.

In an embodiment, the determining, according to the ICMP packet, a network topology relationship of a plurality of the target devices includes:

In an embodiment, the determining a network topology relationship of a plurality of the target devices according to the ICMP packet further includes:

In an embodiment, the determining, according to the ICMP packet, a network topology relationship of a plurality of the target devices further includes:

In one embodiment, after the determining the network topology relationship of the plurality of target devices according to the ICMP packet, the method further includes:

In this embodiment, network data of each device in the network can be monitored in real time, or network data in the network can be acquired from the storage device, data is not actively sent, and an existing message is passively received or analyzed.

In one embodiment, a plurality of logical networks are divided according to VLanID and then each logical network is analyzed, and each logical network analysis method and process are the same. In a logic network, if an ARP/RARP message exists, a source IP is bound with a source Mac, and the source IP is judged as a device; the destination IP and the destination Mac are bound together, and a device is determined. And if no ARP/RARP message exists, judging the device as a Mac address or an IP address.

If there is a PING message in the ICMP message after analysis, the source IP and the target IP are judged as two devices and the connection relation between the two devices is determined.

If there is Traceroute message in the ICMP message after analysis, the message is analyzed according to the protocol, and the relation between the equipment and the connection is determined.

And for other IP messages, determining the source IP and the destination IP in one message as a connection relation. If only one source IP _ A source MAC _ A and destination IP _ B destination MAC _ B and the reverse message source IP _ B source MAC _ B and destination IP _ A destination MAC _ A thereof exist, two devices (IP _ A and IP _ B) are judged and the connection relationship between the two devices is determined. If one IP corresponds to messages of a plurality of MAC addresses, the messages are treated as forwarding messages. For example, a source IP _ a source MAC _1 and a destination IP _ B destination MAC _2, a source IP _ a source MAC _2 and a destination IP _ B destination MAC _3, a source IP _ a source MAC _3 and a destination IP _ B destination MAC _4 … …, determine IP _ a and IP _ B as two devices, and label MAC _2, MAC_3, and the like in the process as forwarding devices, such as gateway devices like routers and the like. If one MAC address corresponds to a plurality of IP messages, such as a source IP _1 source MAC _ A, a source IP _2 source MAC _ A, a source IP _3 source MAC _ A … … or a target IP _1 target MAC _ A, a target IP _2 target MAC _ A and a target IP _3 target MAC _ A, each IP is determined to be a device, and the MAC _ A is determined to be a gateway or a proxy server.

In one embodiment, the feature recognition can be performed on the target device, the application is recognized and traffic statistics is performed according to the feature extracted by the protocol based on the TCP/UDP port and the message load feature. Because the industrial network environment is closed, the connectable devices, services and the like in the network are known, the port number change condition of the known services can be acquired, and the identification technology based on the TCP/UDP port can completely ensure the coverage rate and the identification rate of the message. Meanwhile, due to the closed characteristics of the industrial network environment and the safety requirements of enterprises, some enterprises can customize communication protocols. And perfecting equipment characteristic identification by configuring a port and an application name for the scene through a user.

In one embodiment, the traffic monitoring may also be performed on the target device, and the traffic may be counted and monitored according to the source and destination addresses. And when no flow exists in a certain time, the equipment is considered to be powered off or separated from the network. If the message analysis is obtained in real time, the current system time is directly used, and if no flow of a certain device exists in a time period, the device is considered to be separated from the network.

As shown in fig. 4, in this embodiment, the connection relationship between each device in the network may be generated, and the traffic, including uplink and downlink, may be counted according to the information of the message statistics, such as statistics of uplink and downlink traffic of opuca and MODBUS in the figure, and the asset type, identifying and labeling manufacturer information according to the mac address range assigned to each manufacturer by the international organization or labeling asset information according to the custom information, and connecting the active state, labeling the active state according to the uplink and downlink traffic in unit time, as shown in the following figure, the connection line color is red when the traffic is larger in unit time, and the broken line interval is larger when the time without data transmission is longer.

In this embodiment, the terminal device receives the message of each of the target devices from the gateway device, and determines the network topology relationship of the target devices according to the message of each target device, without configuring and upgrading the target devices in the existing network or sending a request to the target devices in the network by the terminal device, so that no message is generated in the process, the existing network is affected, and the use effect is better.

It should be understood that, although the steps in the flowchart of fig. 1 are shown in order as indicated by the arrows, the steps are not necessarily performed in order as indicated by the arrows. The steps are not performed in the exact order shown and described, and may be performed in other orders, unless explicitly stated otherwise. Moreover, at least a portion of the steps in fig. 1 may include multiple steps or multiple stages, which are not necessarily performed at the same time, but may be performed at different times, which are not necessarily performed in sequence, but may be performed in turn or alternately with other steps or at least a portion of the other steps or stages.

In one embodiment, there is provided an apparatus for determining a network topology, comprising the following program modules:

a third determining module: and the network topology relation of the target devices is determined according to the ICMP message.

For specific definition of the determining device of the network topology, reference may be made to the above definition of the determining method of the network topology, which is not described herein again. The various modules in the network topology determining apparatus described above may be implemented in whole or in part by software, hardware, and combinations thereof. The modules can be embedded in a hardware form or independent from a processor in the computer device, and can also be stored in a memory in the computer device in a software form, so that the processor can call and execute operations corresponding to the modules.

In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as shown in fig. 5. The computer device includes a processor, a memory, a communication interface, a display screen, and an input device connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device comprises a nonvolatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of an operating system and computer programs in the non-volatile storage medium. The communication interface of the computer device is used for carrying out wired or wireless communication with an external terminal, and the wireless communication can be realized through WIFI, an operator network, NFC (near field communication) or other technologies. The computer program is executed by a processor to implement a method of determining a network topology. The display screen of the computer equipment can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer equipment can be a touch layer covered on the display screen, a key, a track ball or a touch pad arranged on the shell of the computer equipment, an external keyboard, a touch pad or a mouse and the like.

Those skilled in the art will appreciate that the architecture shown in fig. 5 is merely a block diagram of some of the structures associated with the disclosed aspects and is not intended to limit the computing devices to which the disclosed aspects apply, as particular computing devices may include more or less components than those shown, or may combine certain components, or have a different arrangement of components.

In one embodiment, a computer device is provided, which includes a memory and a processor, wherein the memory stores a computer program, and all or part of the procedures in the method of the above embodiment are involved.

In one embodiment, a computer-readable storage medium having a computer program stored thereon is provided, which relates to all or part of the processes of the above-described embodiment methods.

It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by hardware instructions of a computer program, which can be stored in a non-volatile computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. Any reference to memory, storage, database or other medium used in the embodiments provided herein can include at least one of non-volatile and volatile memory. Non-volatile Memory may include Read-Only Memory (ROM), magnetic tape, floppy disk, flash Memory, optical storage, or the like. Volatile Memory can include Random Access Memory (RAM) or external cache Memory. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM), among others.

The technical features of the above embodiments can be arbitrarily combined, and for the sake of brevity, all possible combinations of the technical features in the above embodiments are not described, but should be considered as the scope of the present specification as long as there is no contradiction between the combinations of the technical features.

The above-mentioned embodiments only express several embodiments of the present application, and the description thereof is specific and detailed, but not to be understood as limiting the scope of the invention. It should be noted that, for a person skilled in the art, several variations and modifications can be made without departing from the concept of the present application, which falls within the scope of protection of the present application. Therefore, the protection scope of the present patent application shall be subject to the appended claims.

Claims

1. A method for determining a network topology, the method comprising:

2. The method of claim 1, wherein prior to said determining network topology relationships for a plurality of said target devices based on said ICMP packet, said method further comprises:

and determining the MAC address and the IP address of the first target equipment and the MAC address and the IP address of the second target equipment according to the TCP/UDP message.

3. The method of claim 1, wherein prior to said determining network topology relationships for a plurality of said target devices based on said ICMP packet, said method further comprises:

4. The method of claim 1, wherein said determining a network topology relationship of a plurality of said target devices based on said ICMP packet comprises:

5. The method of claim 1, wherein determining network topology relationships for a plurality of the target devices based on the ICMP packet further comprises:

6. The method of claim 1, wherein determining network topology relationships for a plurality of the target devices based on the ICMP packet further comprises:

7. The method of claim 1, wherein after said determining network topology relationships for a plurality of said target devices based on said ICMP packet, said method further comprises:

8. An apparatus for determining a network topology, the apparatus comprising:

9. A computer device comprising a memory and a processor, the memory storing a computer program, characterized in that the processor, when executing the computer program, implements the steps of the method of any of claims 1 to 7.

10. A computer-readable storage medium, on which a computer program is stored which, when being executed by a processor, carries out the steps of the method according to any one of claims 1 to 7.